#!/bin/sh
set -eu

cd /out
rm -f ./*.crt ./*.csr ./*.key ./*.srl ./*.cnf

openssl req -x509 -newkey rsa:2048 -nodes -days 30 \
  -subj "/CN=Demo MITM Root CA" \
  -keyout mitm-ca.key -out mitm-ca.crt

cat > mitm.cnf <<'EOF'
[req]
distinguished_name = dn
prompt = no
[dn]
CN = api.demo.local
[ext]
subjectAltName = DNS:api.demo.local
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment
extendedKeyUsage = serverAuth
EOF

openssl req -new -newkey rsa:2048 -nodes -config mitm.cnf \
  -keyout mitm.key -out mitm.csr
openssl x509 -req -days 7 -sha256 \
  -in mitm.csr -CA mitm-ca.crt -CAkey mitm-ca.key -CAcreateserial \
  -extfile mitm.cnf -extensions ext -out mitm.crt

openssl req -x509 -newkey rsa:2048 -nodes -days 30 \
  -subj "/CN=Demo Upstream Root CA" \
  -keyout upstream-ca.key -out upstream-ca.crt

cat > upstream.cnf <<'EOF'
[req]
distinguished_name = dn
prompt = no
[dn]
CN = api.demo.local
[ext]
subjectAltName = DNS:api.demo.local
basicConstraints = critical,CA:FALSE
keyUsage = critical,digitalSignature,keyEncipherment
extendedKeyUsage = serverAuth
EOF

openssl req -new -newkey rsa:2048 -nodes -config upstream.cnf \
  -keyout upstream.key -out upstream.csr
openssl x509 -req -days 7 -sha256 \
  -in upstream.csr -CA upstream-ca.crt -CAkey upstream-ca.key -CAcreateserial \
  -extfile upstream.cnf -extensions ext -out upstream.crt

# The proxy runs as uid 1337. These are disposable demo keys in a named volume,
# so make them readable without introducing host-specific chown behavior.
chmod 0644 ./*.crt ./*.key
echo "generated demo certificates in /out"